[FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II #460911 Valid Cross-site Scripting – 2019-10-11 – 20 Large-site Quick Edit reparses a Contributor display name into active HTML #3878399 Valid Cross-site Scripting Medium 2026-10-21 – 20 Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-auth #187520 Valid Cross-Site Request Forgery – 2017-11-20 – 21 Infrastructure - Photon - SSRF #204513 Valid Server-Side Request Forgery – 2017-07-17 – 21 DOM Based XSS In mercantile.wordpress.org #230435 Valid Cross-site Scripting – 2017-06-14 – 21 Reflected Swf XSS In ( plugins.svn.wordpress.org ) #270060 Valid No weakness recorded – 2018-09-27 – 21 Arbitrary change of blog's background image via CSRF #881855 Valid Cross-Site Request Forgery – 2020-12-14 – 21 Content Spoofing @ https://irclogs.wordpress.org/ #278151 Valid Access Control – 2017-12-04 – 22 XSS via unicode characters in upload filename #179695 Valid Cross-site Scripting – 2020-08-28 – 23 Wordpress 4.7.2 - Two XSS in Media Upload when file too large. #203515 Valid Cross-site Scripting – 2017-07-17 – 23 Stored XSS on Broken Themes via filename #406289 Valid Cross-site Scripting – 2020-08-25 – 23 Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint #3801107 Valid Access Control Critical 2026-10-12 – 23 WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses #4029867 Valid Access Control Medium 2026-11-05 – 23 Authenticated Stored Cross-site Scripting in bbPress #881918 Valid Cross-site Scripting – 2020-06-29 – 24 wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_roles #3942522 Valid Access Control High 2026-11-05 – 24 Open API For Username enumeration #385322 N/A No weakness recorded – 2018-07-23 – 25 Information Disclosure - Unauthen Leak Private Content #4053546 Valid Information Disclosure Medium 2026-10-10 – 27 Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields #4152553 Valid Information Disclosure High 2026-11-05 – 27 [mercantile.wordpress.org] Reflected XSS via AngularJS Template Injection #230234 Valid Cross-site Scripting – 2017-06-14 – 29 wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list #3933198 Valid Open Redirect Medium 2026-10-30 – 31 Information / sensitive data disclosure on some endpoints #273726 Valid Information Disclosure – 2018-08-22 – 32 Add users to groups who have restricted group invites #538008 Valid Access Control – 2019-07-27 – 32 Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()` #3931771 Valid Cross-site Scripting Critical 2026-08-28 – 32 "Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolons #339483 Valid Cross-site Scripting – 2019-11-16 – 34 Multiple stored XSS in WordPress #221507 Valid Cross-site Scripting – 2018-11-16 – 35 CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content #4043537 Valid Authentication Medium 2026-10-30 – 36 WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCE #3923967 Valid Command and Code Injection High 2026-10-21 – 37 Logic flaw in the Post creation process allows creating posts with arbitrary types without needing the corresponding nonce #404323 Valid Input Validation and Logic – 2019-02-14 – 38 Authenticated XXE #1095645 Valid Injection and Smuggling – 2021-05-18 – 41 Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata` #3931777 Valid File and Path Handling Critical 2026-08-28 – 48 wp-embed XSS on Safari #1238528 Valid Cross-site Scripting – 2023-07-01 – 49 Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations #3893632 Valid Access Control Medium 2026-09-28 – 51 plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabled #222692 Valid Misconfiguration and Insecure Design – 2019-11-03 – 58 Pivilege escalation of any new user to Keymaster caused by CSRF #2999394 Valid Access Control Medium 2025-09-13 – 61 Mssing Authorization on Private Message replies (BuddyPress) #490782 Valid Access Control – 2019-03-08 – 66 Unauthenticated WordPress Database Repair DoS #2786591 N/A Denial of Service High 2024-10-18 – 70 Potential unprivileged Stored XSS through wp_targeted_link_rel #509930 Valid Cross-site Scripting – 2020-01-08 – 80 Clickjacking on donation page #921709 Valid Misconfiguration and Insecure Design – 2020-07-16 – 90 Privilege Escalation via REST API to Administrator leads to RCE #1107282 Valid Access Control – 2021-05-17 – 92 CSRF to HTML Injection in Comments #428019 Valid Cross-Site Request Forgery – 2019-05-13 – 95 Reflected XSS on https://make.wordpress.org via 'channel' parameter #659419 Valid Cross-site Scripting – 2019-08-26 – 97 Wordpress unzip_file path traversal #205481 Valid Misconfiguration and Insecure Design – 2020-01-29 – 119 Stored XSS on byddypress Plug-in via groups name #592316 Valid Cross-site Scripting – 2019-07-27 – 132 RCE as Admin defeats WordPress hardening and file permissions #436928 Valid File and Path Handling – 2020-06-09 – 164 Stored XSS in Private Message component (BuddyPress) Analysed #487081 Valid Cross-site Scripting – 2019-03-08 – 337 Stored XSS Vulnerability Analysed #643908 Valid Cross-site Scripting – 2019-07-18 – 403